topic Why changing forwarder to deployment client changes host? in Deployment Architecture

Why changing forwarder to deployment client changes host?

himynamesdave — Mon, 27 Mar 2017 21:04:38 GMT

RE:

I recently switched our forwarders from being individually managed to deployment clients (as per question here) and encountered one issue: Splunk changed the host value for each event coming from a forwarder to "ID" with all events (indexed as host=ID).

Note, we did not use the deployment server to push down any apps yet, we've only pointed the forwarder at the deployment server (set deploy-poll)

Any ideas as to why this behaviour might happen? I cannot see anything in docs.

Re: Why changing forwarder to deployment client changes host?

ddrillic — Mon, 27 Mar 2017 22:15:49 GMT

Interesting - can't google any similar host=ID case, but the best practice, in my mind, is to explicitly specify the host in the configurations, if possible.

Re: Why changing forwarder to deployment client changes host?

woodcock — Tue, 28 Mar 2017 00:09:09 GMT

This should not have happened and I would ABSOLUTELY file a support case so that somebody will fix this bug. In the meantime, the problem is almost certainly to be found in server.conf on your forwarder. Find the one that was modified most recently and look around. Check this:

[general]
serverName=